Privacy policy
1. General
Himla wants you to feel secure when you provide us with your personal data. This privacy policy explains how we collect, use, disclose and store your personal data and how we guarantee, in general, that your personal data is processed in accordance with current legislation.
2. Who is the personal data controller?
2.1 Himla AB, corporate ID no. 556396-6612 and postal address Söderforsgatan 18, 752 28 Uppsala (referred to in this policy as "Himla"), is the personal data controller for the processing of your personal data when Himla provides and markets products and for other contact with Himla such as visits to our on-line store or service cases via e-mail and phone. As the personal data controller, Himla is responsible for ensuring that your data is processed in a correct and secure manner in accordance with applicable legislation.
2.2 Himla has joint infrastructure with the companies in the Himla group. The transactions with our customers and associated personal data that are covered by that infrastructure are managed and owned centrally by Himla. Himla has overall responsibility for your personal data and guarantees secure processing of your personal data.
3. What personal data we process
Himla collects and processes the following categories of personal data on you as a) a previous customer b) a customer when you make purchases and use our services (c) a member of our Club Himla customer club. We market and and offer our products for sale only to them.
-
Contact details such as name, e-mail address, delivery address, invoicing address and telephone number
-
Personal identification number (Club Himla member identification number)
-
Account details such as e-mail, password and when the account was registered
-
Customer settings for marketing communications and personalised offers
-
Order information such as order number, products ordered, order date, price, discount and purchase history.
-
Payment details such as payment method, card number, card holder, time of the transaction, amount, IP address and payment history.
-
Correspondence and other information on support cases such as notes and e-mail messages during contact with customer services.
-
User-generated data on your interaction with Himla's marketing communications and websites as well as IP address, device information (technical information on computers, mobile phones and other devices that you use, such as browser settings, time zone, operating system), location data and clicking and visiting history which shows, among other things, which of our goods or offers you were interested in, how you interact with our newsletters and which of our events you have registered for.
-
Information provided in competition entries and applications for and review of events or other marketing activities.
4. Sources for collection of personal data
4.1 Himla collects your personal data directly from you when you issue an order, visit Himla's website, participate in our events, click on links in digital marketing communications, come into contact with our customer services and when you otherwise come into contact with Himla and provide your details. Information on you is collected on these occasions to enable you to enter into agreements with Himla and to enable Himla to provide you with its products.
4.2 If you are a Club Himla member, Himla also collects personal data on you during registration for the account and during the period in which you are an account holder such as your purchase history, your customer settings to receive marketing communications and which offers you showed an interest in by visiting our on-line shop and reading or clicking on links in our digital mailings.
4.3 Himla also collects some personal data through cookies that log how you use our website and therefore which contents you prefer. You can find more information about how we use cookies in Himla's cookie policy.
5. Reasons for personal data processing
Himla collects and processes data on you for different purposes. Below we explain the purposes of our processing and provide examples of the processing activities that take place for each purpose. Some of your personal data may be processed for more than one purpose.
a) Management of orders and purchases Processing of personal data for this purpose includes actions to identify you and send order confirmations, manage payments for products ordered and decide which payment methods we can offer you (based on contact details, goods ordered, etc.), deliver orders, notify you of delivery and manage complaint cases. If you do not provide the data, our obligations cannot be fulfilled and we may refuse your order.
b) To provide and manage a Club Himla account We process personal data for this purpose to authorise you to create and log in to your account, confirm your identity, create your personal pages, maintain accurate contact details, manage your settings for marketing communications and personalised offers, take advantage of benefits, make it easier for you to shop in our on-line store by means of pre-populated data and stored digital shopping baskets and enable you to track your order and payment history.
Find out more about registration of a Club Himla account in the terms and conditions for Club Himla. The data we collect to enable us to provide and manage your account is required in order for us to be able to fulfil our obligations under the terms and conditions. If the data is not provided, our obligations cannot be fulfilled and we may refuse to register an account.
c) To provide information and market products We process personal data for this purpose in order to send you mail, e-mails and text messages to inform you of and market Himla's products, services and offers, show recommendations, remind you of abandoned digital shopping baskets and invite you to take part in events, competitions and customer satisfaction surveys.
d) To carry out and manage participation in events, competitions and marketing activities Processing of personal data for this purpose includes such actions as identifying participants, communicating with participants in a competition and announcing winners and awarding prizes, checking participants' ages and communicating with participants before and after an event (for purposes such as confirmation of applications, reminders and reviews).
e) To manage cases received by Himla's customer services The processing of personal data for this purpose includes actions by Himla for purposes such as communicating, confirming the customer's identity, investigating complaints and support cases, answering questions received by customer services or other support functions by e-mail, telephone or digital channels, correcting inaccurate data, providing technical support and caring for the customer relationship.
f) To fulfil legal obligations Personal data is processed for this purpose to enable the Himla group to fulfil requirements contained in laws, judgments or decisions by public authorities. Examples of such requirements include product liability and product safety requirements as well as production of communications and information on product alarms and product recalls (e.g. in the case of a defect or an insanitary product) and obligations to store certain data that can be related to a private individual in accordance with the Swedish Bookkeeping Act. If the information collected by Himla in the context of this purpose is not provided, our legal obligation cannot be fulfilled and in that case we can refuse to allow the order, the purchase or the activity that gives rise to our legal obligations.
g) To prevent abuse and prevent, guard against and investigate crime Personal data is processed for this purpose to prevent abuse of Club Himla accounts and to prevent and investigate suspected cases of theft and fraud, etc. Suspected offences and attempted offences may be reported to the police.
h) To evaluate and develop the Himla group's services, products and systems Processing of personal data for this purpose includes activities to make our on-line shop more user-friendly, develop or emphasise digital functions, improve the products and services we offer our customers, produce supporting data in order to improve product and logistics flows, improve our IT systems to enhance security and compile statistics for marketing and customer analyses.
6. Legal bases for processing your personal data
In order for Himla to have a right to collect and process your personal data, there must be a legal basis for each of the purposes for which the data is processed. The legal bases for our processing are described in this section. Please note that several legal bases may be applicable to the same processing.
a) Legal obligation This basis means that our processing is necessary in order to comply with a legal obligation imposed on Himla, for example to document payment details in order to fulfil the requirements of the Swedish Bookkeeping Act.
b) Contractual obligations This basis means that the processing is necessary for the performance of an agreement with you as a customer or to enable an agreement to be entered into at a later stage. If you hold a Club Himla account, by accepting the Himla Club terms and conditions you have entered into an agreement with Himla that establishes the framework for what processing of your personal data can take place in order to provide, handle and manage the services linked to the account.
During the order, we process your data to fulfil obligations in accordance with Himla's purchasing conditions valid at any given time. It is then necessary, for example, for Himla to register your contact details to enable us to fulfil our obligation to deliver the product and carry out a credit check if you select invoicing as the payment method in order to verify your ability to pay.
c) Legitimate interest This basis means that our personal data processing is based on a balancing of legitimate interests. This means that the processing takes place to allow Himla to assess whether we have a legitimate interest in processing your personal data which outweighs your interest in not having your personal data processed.
7. Storage of your personal data
7.1 Himla will store your personal data for as long as is necessary to fulfil the purposes for which the data is being processed. The length of the storage period thus depends on the purpose for which the data is being processed. In addition, Himla may store the data for longer if such is necessary in order to establish, defend or file a legal claim, e.g. if there is a dispute in progress or if an offence has been reported to the Police Authority. We regularly carry out thinning and remove personal data that is no longer considered necessary.
7.2 Himla stores personal data connected to your Club Himla account for as long as you still have the account. Find out more about this in our membership terms.
8. Overview of our personal data processing
Below we have compiled an overall summary of our personal data processing in order to clearly explain which categories of personal data we process for our various purposes, the legal basis for our processing and for how long we store the data.
Processing of orders
Legal basis: Contractual obligations.
Personal data:
-
Contact details
-
Account details
-
Identification number
-
Order information
-
Payment details
-
Delivery information
Storage period: For five years after your order has been paid for and completed.
To provide a Club Himla account
Legal basis: Contractual obligations Club Himla terms and conditions.
Personal data:
-
Contact details
-
Account details
-
Identification number
-
User-generated data
-
Order information
-
Payment details
-
Delivery information
-
Customer settings
Storage period: For as long as you have a Club Himla account.
To provide information on and market products
Legal basis: Contractual obligations Club Himla terms and conditions, legitimate interest
Personal data:
-
Contact details
-
Account details
-
User-generated data
-
Order information
-
Payment details
-
Delivery information
-
Customer settings
Storage period: For as long as you have a Club Himla account
To carry out and manage participation in events, competitions, etc
Legal basis: Legitimate interest
Personal data:
-
Contact details
-
Identification number
-
Information submitted in competition entries, applications, reviews
Storage period: For one year after the event or competition has been completed
To manage cases received by Himla's customer services
Legal basis: Legitimate interest, contractual obligations
Personal data:
-
Contact details
-
Account details
-
Identification number
-
Order information
-
Payment details
-
Delivery information
-
Membership that grants entitlement to offers
-
Correspondence and other information on support cases
Storage period: For one year after the most recent contact.
To prevent abuse, guard against and investigate crime
Legal basis: Legitimate interest.
Personal data:
-
Contact details
-
Account details
-
Identification number
-
Order information
-
Payment details
-
User-generated data
Storage period: For the time it takes for necessary checks to be carried out.
To evaluate and develop the Himla group's services, products and systems
Legal basis: Legitimate interest.
Personal data:
-
Contact details
-
Account details
-
User-generated data
-
Order information
-
Payment details
-
Customer settings
-
Correspondence and other information on support cases
Storage period: For as long as you have a Club Himla account or for one year after the last time you had any interaction with Himla.
9. Who do we share your personal data with?
9.1 Himla may disclose your data to other companies to enable you to take advantage of our offers and products. The recipients of your personal data can either be Himla's personal data processors, i.e. companies that process your data on our behalf and according to our instructions, or independent personal data controllers, i.e. companies that are independently responsible for processing your data since they have a direct relationship with you as a customer, e.g. Klarna and Postnord.
9.2 Himla may also disclose your data to authorities if such is necessary in order to comply with a law, a regulation or a decision by a public authority or to enable Himla to establish, defend or file legal claims.
9.3 According to the contact you have with Himla, for example if you are the holder of a Club Himla account or receive marketing communications, Himla may disclose your personal data to the following recipients:
-
Companies in the Himla group act as personal data processors for Himla to enable us to fulfil the various purposes specified in this policy. The legal bases for the transfer to our group companies are the same as for our own processing.
-
Companies that provide information from the national population register or other public registers to ensure that we have the correct contact details for you to enable us to manage your orders and purchases and your Club Himla account and the services associated with your account. The data disclosed consists of identification numbers and contact details, with our contractual obligations towards you as the legal basis.
-
Analysis and marketing companies that provide services such as automated marketing tools, analyses, communication and distribution. They help Himla to analyse your data and provide information on and market the products Himla sells. The data disclosed consists of contact details, account details, customer settings, order information and user-generated data on the legal basis of legitimate interest and our contractual obligations towards you as the holder of a Club Himla account.
-
State authorities such as the Police Authority or the Swedish Tax Agency, to which we are obliged to disclose your personal data by law or in accordance with a decision by a public authority or to which we disclose personal data due to a suspected criminal offence or attempted criminal offence. The categories of data disclosed consist of contact details, identification numbers, account details, order information, payment details, user-generated data and video recordings based on a legal obligation imposed on Himla or to enable us to establish, defend or file legal claims.
9.4 4 If you make a purchase at Himla, we can also disclose your personal data to the following recipients in the context of the processing of your order and purchase, on the legal basis of our contractual obligations towards you:
-
Logistics companies and forwarding agents that help us with transport of goods to enable us to deliver our products and services to you. We disclose contact details and order information to these recipients.
-
Partners and suppliers of payment solutions, e.g. card acquiring companies, banks, credit institutions and other financial operators that ensure that you can make payments and that offer you a range of finance solutions. The data disclosed consists of contact details, identification numbers and payment details.
-
Companies that provide financial services such as sales ledgers in the context of the processing of your orders and purchases. The data disclosed consists of contact details, identification numbers, order information and payment details.
-
Suppliers, distributors and subcontractors of products and services that Himla sells that provide the products and assist us with support services, among other things. The data disclosed consists of contact details and order information.
9.5 Himla will not sell your personal data to any third party.
10. Location for storage of your personal data
Himla will primarily process your personal data within the EU/EEA. However, we may also transfer your personal data to a country outside the EU/EEA if we need to share your data with Himla suppliers or partners that are outside the EU/EEA or that store personal data in a country outside the EU/EEA. If your personal data is transferred to any country outside the EU/EEA, Himla will take the action required to transfer the personal data in a lawful manner by ensuring that your personal data is processed securely and with an adequate level of protection comparable to the protection offered within the EU/EEA.
11. The customer's rights
11.1 Himla is responsible for ensuring that your personal data is processed in accordance with current legislation. This section describes your rights associated with our processing of your personal data. We will, at your request or on our own initiative, correct, de-identify, erase or supplement data that has been discovered to be incorrect, incomplete or misleading. If you have any questions about this or wish to exercise any right, please contact us using the details set out below in this policy.
a) Right of access to your personal data At Himla, we wish to be open about how we process your personal data. If you wish to gain insight into the processing we carry out on you, you have a right to request information on the processing, including a copy of your personal data that is being processed, a so-called extract from the register. Please note that in the event of a request for access, we may ask for further information about you to ensure that we are disclosing the information to the right person and what information you wish to access. The extract from the register is free of charge.
b) Right to correction of your personal data Himla is keen to have accurate, current personal data. If the data we have on you is incorrect, you have a right to ask for it to be corrected. You also have a right to supplement any incomplete personal data. At your request, we will correct the inaccurate or incomplete data we process on you as soon as possible.
c) Right to erasure of your personal data We respect the fact that the personal data we process on you is borrowed from you. You therefore have a right to ask Himla to erase your personal data when the data has been processed in an unlawful manner, when it must be erased in order to comply with a legal obligation to which Himla is subject, when it is no longer necessary for the purposes for which it was processed or when you object to a balancing of interests carried out by Himla in relation to a legitimate interest and there is no legitimate interest for information outweighing the right to object.
However, we cannot comply with your request when there are reasons that grant us a right to continue with the processing, e.g. if the personal data is processed on the legal basis of complying with a legal obligation (such as in accordance with the requirements of the Swedish Bookkeeping Act) or if the data is necessary to enable Himla to establish, file or defend legal claims.
d) Right to data portability You have a right to obtain a copy of the personal data relating to you in a structured format and in certain cases to have the data transferred to another personal data controller. Nevertheless, this right only includes data that you yourself have submitted to Himla and that we process on the legal basis of consent or a contractual obligation towards you.
e) Right to restriction of processing You have a right to ask for our processing of your personal data to be restricted in certain situations, which means that the data may only be processed for certain purposes. You may, for example, ask for restrictions on incorrect data when you have requested a correction. The processing of the data will be restricted during the time it takes for Himla to investigate the accuracy of the data.
f) Right to object to certain types of processing When Himla processes your personal data on the legal basis of a balancing of interests relating to a legitimate interest or for direct marketing, you have a right to object to our processing. An objection to a balancing of interests by Himla may be filed when you have personal reasons that relate to the situation. In the event of such an objection, Himla considers whether we have a legitimate reason to process the data that outweighs your interest in protecting your privacy. If that is the case, Himla may continue to process your personal data. You can issue an objection to direct marketing and analyses without giving any reason. If you object to direct marketing, we will discontinue the processing of your personal data for that purpose as well as all types of direct marketing actions. If you only object to personalised offers, communications with you will be of a general nature.
11.2 2 If you consider that we are processing your personal data in an incorrect manner, you are welcome to contact us. Contact details can be found below in this policy. You also have a right to file a complaint regarding processing of your personal data to the Data Protection Authority, which is the supervisory authority responsible for processing of personal data in Sweden.
12. Additional safeguards for your personal data
You must be able to feel secure at all times when you provide us with your personal data. Himla has adopted technical and organisational security measures to protect your personal data against inappropriate or involuntary disclosure, use, unauthorised access, erasure, amendment or damage of your personal data. For example, all customer data is stored in a database protected by a firewall and authorisation control where only authorised Himla employees have access to your data.
13. Application and amendment of the privacy policy
The latest updated version of the Himla privacy policy is always available on our website. Our privacy policy applies at any given time in the form and with the contents published on the website. Himla has a right to update the privacy policy at any time. We may also inform you via e-mail of major amendments to the privacy policy.
14. Contact details
Please do not hesitate to contact us if you have any questions about this privacy policy or if you would like more information about our processing of your personal data.
Do you have questions about GDPR? Please contact customer services on +46 18-56 62 00 or send an e-mail to info@himla.com.